Unless expressly indicated herein, the material presented in this section is not prior art to the claims of the present application and is not admitted to be prior art by inclusion in this section.
General Packet Radio Service (GPRS) is a standard for wireless data communications that allows 3G and 4G/LTE mobile networks to transmit Internet Protocol (IP) packets to external networks such as the Internet. FIG. 1 is a simplified diagram of an exemplary 3G network 100 that makes use of GPRS. As shown, 3G network 100 includes a mobile station (MS) 102 (e.g., a cellular phone, tablet, etc.) that is wirelessly connected to a base station subsystem (BSS) 104. BSS 104 is, in turn, connected to a serving GPRS support node (SGSN) 106, which communicates with a gateway GPRS support node (GGSN) 108 via a GPRS core network 110. Although only one of each of these entities is depicted in FIG. 1, it should be appreciated that any number of these entities may be supported. For example, multiple MSs 102 may connect to each BSS 104, and multiple BSSs 104 may connect to each SGSN 106. Further, multiple SGGNs 106 may interface with multiple GGSNs 108 via GPRS core network 110.
When a user wishes to access Internet 114 via MS 102, MS 102 sends a request message (known as an “Activate PDP Context” request) to SGSN 106 via BSS 104. In response to this request, SGSN 106 activates a session on behalf of the user and exchanges GPRS Tunneling Protocol (GTP) control packets (referred to as “GTP-C” packets) with GGSN 108 in order to signal session activation (as well as set/adjust certain session parameters, such as quality-of-service, etc.). The activated user session is associated with a tunnel between SGSN 106 and GGSN 108 that is identified by a unique tunnel endpoint identifier (TEID). In a scenario where MS 102 has roamed to BSS 104 from a different BSS served by a different SGSN, SGSN 106 may exchange GTP-C packets with GGSN 108 in order to update an existing session for the user (instead of activating a new session).
Once the user session has been activated/updated, MS 102 transmits user data packets (e.g., IPv4, IPv6, or Point-to-Point Protocol (PPP) packets) destined for an external host/network to BSS 104. The user data packets are encapsulated into GTP user, or “GTP-U,” packets and sent to SGSN 106. SGSN 106 then tunnels, via the tunnel associated with the user session, the GTP-U packets to GGSN 108. Upon receiving the GTP-U packets, GGSN 108 strips the GTP header from the packets and routes them to Internet 114, thereby enabling the packets to be delivered to their intended destinations.
The architecture of a 4G/LTE network that makes uses of GPRS is similar in certain respects to 3G network 100 of FIG. 1. However, in a 4G/LTE network, BSS 104 is replaced by an eNode-B, SGSN 106 is replaced by a mobility management entity (MME) and a Serving Gateway (SGW), and GGSN 108 is replaced by a packet data network gateway (PGW).
For various reasons, an operator of a mobile network such as network 100 of FIG. 1 may be interested in analyzing traffic flows within the network. For instance, the operator may want to collect and analyze flow information for network management or business intelligence/reporting. Alternatively or in addition, the operator may want to monitor traffic flows in order to, e.g., detect and thwart malicious network attacks.
To facilitate these and other types of analyses, the operator can implement a network telemetry, or “visibility,” system, such as system 200 shown in FIG. 2 according to an embodiment. At a high level, network visibility system 200 can intercept traffic flowing through one or more connected networks (in this example, GTP traffic between SGSN-GGSN pairs in a 3G network 206 and/or GTP traffic between eNodeB/MME-SGW pairs in a 4G/LTE network 208) and can intelligently distribute the intercepted traffic among a number of analytic servers 210(1)-(M). Analytic servers 210(1)-(M), which may be operated by the same operator/service provider as networks 206 and 208, can then analyze the received traffic for various purposes, such as network management, reporting, security, etc.
In the example of FIG. 2, network visibility system 200 comprises two components: a GTP Visibility Router (GVR) 202 and a GTP Correlation Cluster (GCC) 204. GVR 202 can be considered the data plane component of network visibility system 200 and is generally responsible for receiving and forwarding intercepted traffic (e.g., GTP traffic tapped from 3G network 206 and/or 4G/LTE network 208) to analytic servers 210(1)-(M).
GCC 204 can be considered the control plane of network visibility system 200 and is generally responsible for determining forwarding rules on behalf of GVR 202. Once these forwarding rules have been determined, GCC 204 can program the rules into GVR 202's forwarding tables (e.g., content-addressable memories, or CAMs) so that GVR 202 can forward network traffic to analytic servers 210(1)-(M) according to customer (e.g., network operator) requirements. As one example, GCC 204 can identify and correlate GTP-U packets that belong to the same user session but include different source (e.g., SGSN) IP addresses. Such a situation may occur if, e.g., a mobile user starts a phone call in one wireless access area serviced by one SGSN and then roams, during the same phone call, to a different wireless access area serviced by a different SGSN. GCC 204 can then create and program “dynamic” forwarding rules in GVR 202 that ensure these packets (which correspond to the same user session) are all forwarded to the same analytic server for consolidated analysis.
Additional details regarding an exemplary implementation of network visibility system 200, as well as the GTP correlation processing attributed to GCC 204, can be found in commonly-owned U.S. patent application Ser. No. 14/603,304, entitled “SESSION-BASED PACKET ROUTING FOR FACILITATING ANALYTICS,” the entire contents of which are incorporated herein by reference for all purposes.
In certain embodiments, as part of the traffic analysis performed by analytic servers 210(1)-(M), servers 210(1)-(M) may be interested in categorizing the data packets they receive from GVR 202 according to various criteria. For instance, analytic servers 210(1)-(M) may want to categorize the data packets based on the physical network path, or “circuit,” they originated from in 3G network 206 or 4G/LTE network 208. Analytic servers 210(1)-(M) can then use this information to facilitate their analyses. By way of example, assume that an analytic server 210 sees that data packets in a certain flow are being dropped or delayed. In this case, if the data packets are categorized according to their point of origin in source network 306 or 208, the analytic server can determine that there is a problem with the physical network path/circuit from which the affected data packets originated. The network provider can thereafter take appropriate steps for addressing the problem with that particular circuit.
One issue with performing this packet categorization on analytic servers 210(1)-(M) is that the analytic servers may not have sufficient compute resources to perform the categorization in an efficient manner. This may be particularly true if a high volume of traffic is sent from GVR 202 to servers 210(1)-(M) on a continuous basis. Another issue with performing this packet categorization on analytic servers 210(1)-(M) is that the analytic servers may not have access to all of the information needed to successfully carry out the categorization task. For instance, in the example above where analytic servers 210(1)-(M) are interested in categorizing data packets according to the network circuit their originated from in source networks 206/208, servers 210(1)-(M) may not be able to ascertain the source circuit for each data packet without knowing which ingress port of GVR 202 received the packet. This ingress port information would only be known to the components of network visibility system 200 (i.e., GVR 202 and GCC 204).